Filtered antivirus scanning

Abstract

An antivirus client module (114) includes a virus definitions module (312) holding information describing characteristics of files that can potentially be infected by viruses and information enabling a determination of whether a file is actually infected by a virus. The client module (114) also includes a filtering module (314) having a file information cache (410) describing characteristics of files. A file scanning module (316) can scan files to determine whether the files are infected by viruses. The antivirus client module (114) queries the file information cache (410) using the information describing characteristics of files to identify the set of files that are susceptible to a given virus. The file scanning module (316) scans the files in the set.

Description

BACKGROUND OF THE INVENTION[0001]1. Field of the Invention[0002]This invention pertains in general to detecting computer viruses and in particular to techniques for enabling faster antivirus scanning.[0003]2. Background Art[0004]Modern computer systems are under constant threat of attack from computer viruses and other malicious code. Viruses often spread through the traditional route: a computer user inserts a disk or other medium infected with a virus into a computer system. The virus infects the computer system when data on the disk are accessed.[0005]Viruses also spread through new routes. A greater number of computer systems are connected to the Internet and other communications networks than ever before. These networks allow a computer to access a wide range of programs and data, but also provide a multitude of new avenues by which a computer virus can infect the computer. Some viruses exploit the broad reach of the networks and can spread rapidly to thousands or millions of c...

AI Technical Summary

Benefits of technology

[0009]The above need is met by an antivirus client module (114) that identifies the set of files that are susceptible to a given virus, and scans only those files to determine whether they are infected by the virus. In one embodiment, the antivirus client module (114) includes a virus definitions module (312) holding information describing characteristics of files that can potentially be infected by viruses and information enabling a determination of whether a file is actually infected by a virus. The antivirus client module (114) also includes a filtering module (314) having a file information cache (410) describing characteristics of files. The antivirus client module (114) queries the file information cache (410) using the information describing characteristics of files to identify the set of files that are susceptible to a given virus. The antivirus client module (114) causes a file scanning module (316) to scan only the set of susceptible files for the virus. Thus, the scanning is performed efficiently and quickly.

Problems solved by technology

Modern computer systems are under constant threat of attack from computer viruses and other malicious code.

The virus infects the computer system when data on the disk are accessed.

This task has become more difficult in recent times because the number of files on a typical computer system has increased dramatically.

Thus, there is a much larger pool of potentially-infected files that the antivirus software must scan.

Moreover, scanning an individual file for the presence of a virus takes longer now than in the past.

As a result, antivirus software must use more advanced and time consuming technologies, such as software emulation, to detect the presence of viruses.

The increased pool of potentially-infected files and the need to perform time consuming virus detection techniques have resulted in a major increase in the amount of time required to scan a computer system for a virus.

This scan can tie up the computer system for hours or, in extreme cases, days.

Since virus outbreaks occur frequently, the lost productivity associated with antivirus scanning is significant.

Images